CVE-2026-75935 and CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service

CVE-2026-75935 & CVE-2026-75936 - Issue with Amazon ion-java - Memory-amplification denial of service

Bulletin ID: 2026-083-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/18/2026 12:30 PM PDT
Last Updated Date: 9/16/2026 09:30 AM PDT

ion-java is a Java library that implements the Amazon Ion data format specification. We identified CVE-2026-75935, memory-amplification denial of service via declared-length preallocation, and CVE-2026-75936, memory-amplification denial of service via highly compressed data expansion.

These issues have been addressed in ion-java version 1.12.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Users should configure a limited maximum buffer size via IonBufferConfiguration.withMaximumBufferSize to cap growth and should manually disable automatic GZIP decompression via IonReaderBuilder.withGzipDecompressionEnabled(false) if handling untrusted input.

Prior to version 1.12.0, there is no workaround effective for all encodings accepted by ion-java parsers ([text, binary] x [GZIP, uncompressed]), but configuring the parser with a limited maximum buffer size via IonBufferConfiguration.withMaximumBufferSize is effective for all combinations except GZIP-encoded text Ion.